Chapter 9

Question 1

2. What is one way of checking emails for virus infections?
   A. Block all emails with attachments.
   B. Block all active attachments (for example, Active, scripting).
   C. Look for subject lines that are from known virus attacks.
   D. Look for emails from known virus sources.

Answer 1

C. Look for subject lines that are from known virus attacks.

Question 1

1. Which of the following is the most common way for a virus scanner to recognize a virus?
   A. To compare a file to known virus attributes
   B. To use complex rules to look for virus-like behavior
   C. To look for only TSR programs
   D. To look for TSR programs or programs that alter the Registry

Answer 1

A. To compare a file to known virus attributes

Question 2

3. What are TSR programs?
   A. Terminal signal registry programs, which alter the system Registry
   B. Terminate and system remove programs, which erase themselves when complete
   C. Terminate and scan remote programs, which scan remote systems prior to terminating
   D. Terminate and stay resident programs, which stay in memory after you shut them down

Answer 2

D. Terminate and stay resident programs, which stay in memory after you shut them down

Question 3

4. What is the name for scanning that depends on complex rules to define what is and is not a virus?
   A. Rules-based scanning (RBS)
   B. Heuristic scanning
   C. TSR scanning
   D. Logic-based scanning (LBS)

Answer 3

B. Heuristic scanning

Question 4

5. Which of the following is not one of the basic types of firewalls?
   A. Screening firewall
   B. Application gateway
   C. Heuristic firewall
   D. Circuit-level gateway

Answer 4

C. Heuristic firewall

Question 5

6. Which of the following is the most basic type of firewall?
   A. Screening firewall
   B. Application gateway
   C. Heuristic firewall
   D. Circuit-level gateway

Answer 5

A. Screening firewall

Question 6

7. George is responsible for security on a midsized network. He has more than two dozen systems that generate logs. What technology would be most helpful for him in analyzing these logs?
   A. SIEM
   B. IDS/IPS
   C. NGFW
   D. PKI

Answer 6

A. SIEM

Question 7

8. What does SPI stand for?
   A. Stateful packet inspection
   B. System packet inspection
   C. Stateful packet interception
   D. System packet interception

Answer 7

A. Stateful packet inspection

Question 8

9. What is the term for a firewall that is software installed on an existing server?
   A. Network host-based firewall
   B. Dual-homed firewall
   C. Router-based firewall
   D. Screened host

Answer 8

D. Screened host

Question 9

10. What is a major weakness with a network host-based firewall?
    A. Its security depends on the underlying operating system.
    B. It is difficult to configure.
    C. It can be easily hacked.
    D. It is very expensive.

Answer 9

A. Its security depends on the underlying operating system.

Question 10

11. What is the term for blocking an IP address that has been the source of suspicious activity?
    A. Preemptive blocking
    B. Intrusion deflection
    C. Proactive deflection
    D. Intrusion blocking

Answer 10

A. Preemptive blocking

Question 11

12. What is the term for a fake system designed to lure intruders?
    A. Honey pot
    B. Faux system
    C. Deflection system
    D. Entrapment

Answer 11

A. Honey pot

Question 12

13. Which of the following is the correct term for making a system less attractive to intruders?
    A. Intrusion deterrence
    B. Intrusion deflection
    C. Intrusion camouflage
    D. Intrusion avoidance

Answer 12

A. Intrusion deterrence

Question 12

14. What method do most IDS software implementations use?
    A. Anomaly detection
    B. Preemptive blocking
    C. Intrusion deterrence
    D. Infiltration

Answer 12

A. Anomaly detection

Question 13

15. How do most antispyware packages work?
    A. By using heuristic methods
    B. By looking for known spyware
    C. The same way antivirus scanners work
    D. By seeking out TSR cookies

Answer 13

B. By looking for known spyware